I recommend something like this. You can manipulate it further to make the formatting pretty or easy to read. You could also attempt a transaction, but I think this will be faster. Also, you will want to mess with the span in the bin command. 5 minutes may be too small. You could make that a token for a dashboard input, like with userid.
sourcetype=wineventlog* Account_Name=$userid$ EventCode=4740 OR EventCode=4625
| bin _time span=5m
| stats values(Message) values(EventCode) AS EventCodes by _time
| eval EventCodeCount=mvcount(EventCodes)
| search EventCodeCount=2
... View more